Getting Data In

Issue with Sourcetype name

alexspunkshell
Contributor

I am getting different sourcetype name in my logs. But I want the sourcetype name as per conf file.

Below are the screenshots of input.conf, props.conf & transforms.conf .

alexspunkshell_0-1695400950043.png

Props & Transforms

alexspunkshell_2-1695401306383.png

 

Inputs

alexspunkshell_3-1695401342803.png

 

 

 

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Please use btool to ensure no other files add settings for the sourcetype.

 

splunk btool --debug props list vclog | grep -v "system\/default"

 

What query created the output in the first screenshot?

---
If this reply helps you, Karma would be appreciated.
0 Karma

alexspunkshell
Contributor

@richgalloway  No luck!  But I confirm there is no other files and settings.

Command used : index=vmware | stats count by sourcetype

Currently syslog is ingesting via universal forwarder.

Current configuration

input.conf
[monitor:///opt/syslog/vmware/10.149.xx.xx/*-syslog.log]
disabled = false
host_segment = 4
index = vmware-vclog
sourcetype = vclog
initCrcLength = 2048

Props.conf
[source::/opt/syslog/vmware/10.149.xx.xx/*]
TRANSFORMS-null= setnull

[vclog]
LINE_BREAKER = ([\r\n]+)\<\d+\>\d
SHOULD_LINEMERGE = false

transforms.conf
[setnull]
REGEX = ^\w+\W
DESK_KEY = queue
FORMAT = nullQueue

0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...